REMARKS 

This Preliminary Amendment cancels without prejudice original claims 1 to 7 
in the underlying PCT Application No. PCT/DE03/00779. This Preliminary Amendment 
adds new claims 8 to 12. The new claims, inter alia, conform the claims to United States 
Patent and Trademark Office rules and do not add new matter to the application. 

In accordance with 37 C.F.R. § 1.125(b), the Substitute Specification 
(including the Abstract, but without claims) contains no new matter. The amendments 
reflected in the Substitute Specification (including Abstract) are to conform the Specification 
and Abstract to United States Patent and Trademark Office rules or to correct informalities. 
As required by 37 C.F.R. §§ 1.121(b)(3)(ii) and 1.125(c), a Marked-Up Version of the 
Substitute Specification comparing the Specification of record and the Substitute 
Specification also accompanies this Preliminary Amendment. Approval and entry of the 
Substitute Specification (including Abstract) are respectfully requested. 

The underlying PCT Application No. PCT/DE03/00779 includes an 
International Search Report, dated September 11, 2003, a copy of which is included. The 
Search Report includes a list of documents that were uncovered by the Examiner in the 
underlying PCT application. A copy of the Search Report accompanies this Preliminary 
Amendment. 

It is respectfully submitted that the present invention is new, non-obvious, and 

useful. Prompt consideration and allowance of the claims are respectfully requested. 
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METHOD FOR MONITORING AT LEAST ONE SENSOR 
Background Information Field of the Invention 

The present invention otarto out from relates to a method for 
monitoring at least one sensor according to the acpcioo of the 
independent claim . 

Advantgco of — the — Invention 
Summary 

The method of the present invention for monitoring at least one 
sensor having the fcaturco of the independent claim has the 
advantage that a reaction adapted to an error pattern having a 
certain error message may occur^ and that each sensor error is 
prevented from resulting in the sensor signal not being able to 
be used or in the system identifying a permanent sensor error and 
consequently a system defect. As a result, interference that 
does not signify lasting sensor damage and may even be attributed 
to rare yet possible operating states is not penalized too 
strictly. Examples of this are electromagnetic interference 
coupling and hammer blow-related vibrations. This improves the 
operability or sensitivity of the systems and reduces the 
probability of control unit field outage. In particular, the 
present invention renders it possible via adaptation and 
application for the particular target control unit and vehicle to 
better address the different system requirements or customer 
requirements with respect to activation parameters and error 
management . 

Consequently, the performance and robustness of the entire system 
are able to be increased, and the field outage rates are able to 
be reduced since as a result of the more in-depth error pattern 
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* detection, total sensor failure is not detected for all error 
patterns. In addition, the present invention is advantageous 
because error detection and optimization are able to be 
facilitated in the restraint system development and testing 
phase. However, use of the present invention is also possible 
and practical in other automobile application areas in which 
sensors are used, in particular in vehicle dynamics control and 
navigation . 

It is particularly advantageous for the parameters from which the 
error pattern is formed to include at least one error message 
and/or a time duration of the at least one error message or error 
and/or at least one sensor signal of the sensor to be checked 
and/or at least one additional sensor signal of at least one 
additional sensor and/or at least one status signal of a vehicle 
component. This allows exact analysis of the error which may be 
corrected in particular , e.g., using a look-up table. The error 
pattern is generated using the look-up table in the processor of 
the control unit and may then be evaluated accordingly. In 
particular^ it is consequently possible for the control unit to 
detect whether the error is a permanent error and how significant 
the error is. 

The mcaourco and further rcfincmcnto opacified in the dependent 
claimo render possible — advant agcouo — improvemento of — the method 
for monitoring at least one sensor recited in the independent 
claim. 

It is particularly advantageous that a rotation-rate sensor is 
used in which an error word is transmitted in an 8 -bit word, 
provided with the abbreviation MONI in this case, in a 16 -bit 
frame. In this context, the error type or modes are characterized 
in this word by flags. Therefore, different detected error modes 
and extraordinary operating states are indicated by this word. 
Error modes indicate that at least one sensor parameter is 
outside of a predefined range. The sensor parameters are 
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monitored inside the sensor. The word MONI may be accordingly 
assigned information doubly or multiply via two or more different 
MONI read commands . 



If during such a monitoring operation an error is detected, a 
respective value is set in a respective register. This means that 
an error register is assigned a logical 1. If this error is no 
longer detected, the respective register is reset. Therefore, a 
logical 0 is set again. 

It is also advantageous that the sensor itself is positioned 
within the housing of the control unit . The sensor and the 
processor of the control unit arc thcn may then be connected to 
one another via the digital interface and preferably SPI (serial 
peripheral interface) lines, respectively , for example . 

Drawing 

Exemplary ombodimcnto of the present — invention arc ohown in the 
drawing and arc explained more closely in the following 
description. 

The figures show: Brief Description of the Drawings 

Figure 1 shows a block diagram of the control unit of the present 
invention [ [;]] j_ 

Figure 2 shows a data telegram o f format used in the present 
invention [ [ ; ] ] j_ 

Figure 3 shows a look-up table^ 

Figure 4 shows a block diagram of the method of the present 
i nven t i on-? — a-ftet . 
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Figure 5 shows a flow chart of the method of the present 
invention . 



Dcocription Detailed Description 

Rotation-rate sensors, as well as other sensors, are used 
increasingly in electronic restraint systems for passive vehicle 
safety. Rotation-rate sensors are integral in the detection of 
rollover occurrences and related accident occurrences, e.g. the 
soil trip. 

The rotation-rate sensors used in the restraint systems generally 
have an internal sensor monitoring function. In the case of 
analog sensor interfaces to the system, an identified error or 
interference state that may have a wide range of causes is 
communicated via a logic signal (error, no error) to a sensor 
platform, a control unit, generally a microcontroller, or a 
safety semiconductor . 

Digital sensors provide the possibility that — 3-s enable a 
relatively simple to implement — in technical — terms to 
t ranomi t imp 1 ement a t i on for t r ansmi 1 1 i ng different errors and 
interference states to the system via fixedly assigned bits in 
data words. In this context, every bit is assigned an error flag 
that is then assigned to a circuit block or a measured variable 
inside the sensor. The internal sensor monitoring function 
generally responds when^ and as long as^_ one of the various 
monitored measured variables inside the sensor assumes a value 
not allowed for the corresponding sensor. The causes may vary if* 
relation to depending on the sensor evaluation circuit function 
blocks . 

Possible causes of interference or error states: 
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In the case of rotation-rate sensors used in automobile systems, 
principle-related vibration or mechanical interference 
susceptibility is a characteristic property to be taken into 
consideration in the sensor application. If no mechanical 
damping occurs, the performance of the systems is imitated. 
Mechanical damper construction entails significant additional 
development and production costs. Impacts and significant 
vibrations may interfere with the sensor element so significantly 
that internal sensor regulations are no longer effective for a 
certain time and the sensor operation is outside its specified 
function range. Further possible interference includes 
electromagnetic interference coupling. Errors in the sensor 
itself or in the application circuit may also affect system 
functioning. The effects differ depending on rotation-rate 
sensor error, interference type, and also application environment 
of the sensor, jr^e . g . , the circuit, circuit board, and vehicle 
construction . 

To date, the rotation-rate sensor monitoring function has been 
used on the system side only for basic error detection-: — Thio 
mcano , i.e., to determine whether the sensor is OK. The restraint 
system differentiates with respect to its reaction over the time 
duration of the error message on the basis of whether there is a 
rotation-rate sensor failure. The particular system reaction is 
not adjusted to the different error messages. 

Since there is no classification of the different error patterns 
on the system side and the application environment is not 
applied, the "worst case scenario" principle must be followed. A 
faulty state identified by the monitoring function ao faulty 
results in the sensor signal not being able to be used^ or in the 
system being identified as having a permanent sensor error and 
consequently a system defect. As a result, interferences that do 
not signify lasting sensor damage and may even be attributed to 
rare yet possible operating states are generally penalised too 
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strictlyd given too much significance . This limits the performance 
or sensitivity of the systems^ or increases the probability of a 
possibly unnecessary control unit field outage. 

Therefore, an error word transmitted from the sensor to the 
system, prcf crably e . g . , a processor of the control unit, and 
having a combination of different error modes^ and thereby 
transmitting precise information regarding the error type and 
cause to the system^ is used in accordance with the present 
invention- The system consequently reacts to the error word in an 
adapted manner. 

Error patterns due to various error and interference causes arc 
alrcady may be recorded in the development and application phase 
of restraint system electronics systems- — This , which makes it 
possible to complete a look-up table. In this context, the 
particular error pattern may be comprised of an error message or 
an error word, an error state word, a time duration of the error 
message, a sensor output signal, and additional sensor signals 
available in the system as well as status information. The 
availability of such a look-up table allows the system to react 
appropriately to the particular error pattern. Error patterns 
that are unknown or are not secured by testing are 

penal izcd treated as a worst case. Consideration of the particular 
correctly present vehicle environment allows a further increase 
in the detection precision of errors and interference causes. 

A practical requirement for implementing the present invention is 
a digital sensor interface- — Only in thio manner arc a greater ^ 
which allows a number of different errors and interference modes 
or patterns and also combinations thereof that occur in a sensor 
able to be transmitted to the system. The bi-directional SPI 
(serial peripheral interface) is used as an example in this 
instance . 
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Figure 1 shows a block diagram of the control unit of the present 
invention. Located in a control unit 10 is a sensor 1, which is 
connected to a processor 7 via a digital line 6. Processor 7 is 
connected via a data input/output to a memory 8. Processor 7 is 
connected via a data output to a restraint system 9. Located in 
sensor 1 is a sensor element 2 for measuring a measured variable, 
e.g. of rotation rates or rotational accelerations. The sensor 
element may be in particular a micromechanical sensor structure. 

Sensor element 2 is connected to a functional and monitoring 
component 3, in which the analog-digital conversion of the sensor 
signal, in some instances the drive and regulation of the sensor 
element, and the internal sensor monitoring functions are 
performed. Functional and monitoring component 3 is connected via 
a data output to a transmitter component 4 . Transmitter 
component 4 is connected to digital line 6, which is configured 
here as an SPI (serial peripheral interface) line. One or more 
sensors 5, the signals of which are transmitted via the SPI and 
are also applied to the error pattern, may also be connected to 
the SPI. 

Figure 4 shows the method steps by which measured values are 
processed here . Specific rotation-rate sensor error words 17 
transmitted as 8 -bit words are used to generate the error 
pattern. A variable 18 provides the particular time duration of 
the individual error messages. A variable 19 provides the sensor 
value determined via sensor element 2. This is also monitored for 
operability. A variable 2 0 jr emay be used if applicable to 
process the variables from other sensors 5. They may also provide 
a type of plausibility for the error message. Variable 21 
provides other status information regarding the restraint system 
or other vehicle components. These are also applied to the error 
pattern generation. These input variables are then uocd by 
evaluation module applied in function block 16 to the transmitter 
component (evaluation module) 4_^_ via which utilizes a stored 
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look-up table, i.e. a matrix, to generate an error pattern. The 
input parameters determine the rows and columns of the matrix and 
then result in the generation of the error pattern in function 
block 22, the system then reacting to this error pattern in 
function block 23 after transmission to processor 7. Processor 
1 j_ io aloo dcoigncd via its memory 8^ for decoding decodes the 
error pattern so that it is clear to processor 7 which errors 
rcoultcd i n caused this error pattern. If there are error patterns 
that are not known iRto processor 7, a worst case is assumed, 
i.e., sensor failure. As a function of this, the processor 
detects failure of the subsystem affected by this sensor failure 
and introduces corresponding measures. 

Figure 3 schematically shows ouch an example of a matrix 
designated here as the look-up table. The input parameters are in 
columns 14 and 13 and the error pat tcrs pat terns that 
bclong correspond to these input parameters are then in field 15. 

Figure 2 schematically shows a data frame of 16 bits^ that which 
frame is divided into a first part 12 and a second part 11. 

Error word 11 (MONI) is transmitted in second part 11- Two , or 

two error words may be transmitted here. B r ror A first error word 
^is read out via a first read command— and a second error word 
2- is read out via a second read command— 2-. 

Figure 5 shows a flow chart of the method of the present 
invention. As shown above, the error pattern is generated in 
method step 24 on the basis of input parameters 17 through 21 
input in function block 16 (in Fig. 4) using a look-up table 
according to shown in Figure 3. The error pattern is then 
transmitted in method step 25 to processor 7. The processor 
reacts to this error pattern in method step 26. 

Sensor 1 may alternatively be located outside of control unit 10. 

Instead of only one sensor 1, a plurality of sensors of 
different types may also be used and monitored. In addition to 
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the restraint system addressed here, other vehicle systems are 
also suitable for this invention, e.g. a vehicle dynamics system 
or navigation syste m, which may be represented by element 9 
(restraint system in the example embodiment) in Figure 1 . 
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Abstract 



ABSTRACT 



Proposed io a A method for monitoring at least one sensor is 
provided . In this context, error words are transmitted from the 
sensor to the control unit and additional different information 
characterizing error images is used to enable an adapted response 
to these parameters by the processor. Extraordinary operating 
states are tranomittcd indicated in this context in addition to 
errors. The different error images are recorded in the control 
unit application phase and result in error image-specific system 
reactions via a look-up table. 

(Figure — 4^- 
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